File management method for preventing secret leakage
By binding the files uploaded by the user to their organization and using the RSA2 asymmetric encryption algorithm for encryption processing, encrypted file management based on two-factor authentication of the organization and individual is realized, solving the problem that encrypted files cannot be processed on non-working computers and cannot be protected in the existing technology, and improving the processingability and security of encrypted files.
Patent Information
- Application Number
- CN202411767524.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-04-11
- Publication Date
- 2025-03-25
AI Technical Summary
Existing encryption and decryption programs cannot process working files on non-working computers, and cannot effectively control outgoing encrypted files, resulting in the risk of file leakage.
By binding the files uploaded by users to their organization and encrypting the files using RSA2 asymmetric encryption algorithm, encrypting files based on two-factor authentication of organizations and individuals is realized. For internal requests of the organization, verify the user's identity information and decrypt it; for external requests of the organization, only temporary users can decrypt the file after obtaining permissions and time limits.
Improve the processingability and security of encrypted files, ensure the safe use of files on non-working computers, and effectively prevent file leakage through two-factor verification and temporary user rights control.
Smart Images
Figure HDA0005169367950000011
Abstract
Description
[0001] This application is a divisional application of the invention patent application with Chinese patent application number 202310377701.6, application date April 11, 2023, and invention name “A file management method to prevent leakage”. Technical Field
[0002] The present invention relates to the technical field of file management, and in particular to a file management method for preventing leakage. Background Art
[0003] In the biopharmaceutical industry, all documents related to drug laboratory research and development, clinical trials, and production records are the most confidential assets of pharmaceutical companies. The leakage of any document may lead to significant losses, and pharmaceutical companies cannot afford such risks. Therefore, strict encryption and decryption technology is required to prevent data leakage when using information systems to manage file assets.
[0004] Existing encryption and decryption programs can only ensure that files in the computer can only be opened in one's own computer, or identify which computers can open company files based on the computer network card MAC address whitelist, resulting in employees being unable to process any work files on non-work computers. At the same time, it is also impossible to control the situation where files need to be sent out when necessary. After the files are decrypted, they will not be protected when sent out. Summary of the invention
[0005] The technical problem to be solved by the present invention is to improve the processability and security of encrypted files, and the purpose is to provide a file management method that prevents leakage.
[0006] The present invention is achieved through the following technical solutions:
[0007] A file management method to prevent leakage includes the following steps:
[0008] After receiving the file uploaded by the user, the file is bound to the organization of the user and the file is encrypted to obtain the encrypted file and key;
[0009] After receiving the request sent by the user, determine the source of the request. If the request comes from within the organization, verify the identity information of the user. If the verification is successful, use the key to decrypt the encrypted file to obtain the decrypted file.
[0010] If the request comes from outside the organization, determine whether the user is a temporary user designated by the organization. If the user is a temporary user designated by the organization, configure permissions and access time for the user, send a key to the user, decrypt the encrypted file, and obtain a decrypted file.
[0011] Bind the file uploaded by the above user to the organization to which the user belongs, and then encrypt the file so that the encryption operation of the file is performed based on the dual verification of the organization and the individual;
[0012] For requests within the organization, the decryption operation can be completed by verifying the user's identity information, so that the user of the encrypted file is a user within the organization, and then the encrypted file is decrypted using the key, so that the operation of decrypting the file within the organization is based on the dual verification of the organization and the individual, which improves the security of the file;
[0013] The internal request is to verify the user's identity information. Once the verification is passed, the encrypted file can be decrypted using the key, which removes the closeness of the connection between the user and the designated computer. This solves the problem that the existing encryption and decryption programs can only guarantee that the files in the computer can only be opened in one's own computer, or identify which computers can open company files based on the computer network card MAC address whitelist, resulting in employees being unable to process any work files on non-work computers, thereby improving the processability of encrypted files.
[0014] For requests from outside the organization, the user must be a temporary user designated by the organization and have the corresponding permissions to obtain the key of the encrypted file, and use this key to decrypt the encrypted file to obtain the decrypted file. The operation of decrypting the encrypted file outside the organization is also based on the dual verification of the organization and the individual, which further improves the security of the encrypted file. An access time is set for temporary users. If the access time is exceeded, the permission will be terminated, making the temporary user lose the qualification to use the encrypted file. The encrypted files sent out can also be managed and controlled, which improves the security of the encrypted files.
[0015] Furthermore, the uploaded files are encrypted using the RSA2 asymmetric encryption algorithm.
[0016] Furthermore, the key includes an organization key, and after the organization key is obtained, the organization key is bound to the organization.
[0017] As the owner of the encrypted file, the organization needs to use the above-mentioned organizational key to obtain the organization's permission to further obtain the encrypted file when decrypting the encrypted file. The encrypted file is multiplexed and the security of the encrypted file is improved.
[0018] Furthermore, the key also includes a file key. After the file key is obtained, the file key is bound to the encrypted file.
[0019] After obtaining the organization's use permission using the above-mentioned organization key, the encrypted file is further obtained, and the encrypted file is decrypted using the above-mentioned file key to obtain the decrypted file. The encrypted file is multiplexed for protection, thereby improving the security of the encrypted file.
[0020] Furthermore, the specific steps for verifying the user's identity information are as follows:
[0021] After receiving the user's internal request, send verification information to the user;
[0022] After receiving the verification information, the user sends the login account and password for preliminary verification of the user's identity information;
[0023] After receiving the login account and login password, the login account is matched with the verification account in the verification database. If the verification account corresponding to the login account is matched in the verification database, the verification password associated with the verification account is extracted from the verification database, and the login password is matched with the extracted verification password. If the verification password corresponding to the login password is matched in the extracted verification password, the preliminary verification is passed; otherwise, the preliminary verification fails and the preliminary verification operation needs to be performed again;
[0024] After the initial verification is passed, check whether the login account has the permission to use the encrypted file. If the login account has the permission to use the encrypted file, the secondary verification is passed; otherwise, the secondary verification fails and the user cannot use the encrypted file.
[0025] After the second verification is passed, it is checked whether the login account belongs to the organization. If the login account belongs to the organization, the third verification is passed, and the file key of the encrypted file is obtained. The encrypted file is decrypted using the file key to obtain the decrypted file; otherwise, the three verifications fail and the user cannot use the encrypted file.
[0026] For the above-mentioned requests within the organization, it is preliminarily verified whether the user's login account and password are correct. After the verification is passed, it is necessary to inquire whether the login account has the permission to use the encrypted file. First, users who do not have access to the encrypted file are excluded, reducing system congestion and improving access efficiency. Because the present invention adopts a cloud-based open SaaS product, which is different from a local area network system that is not connected to the Internet, there is a situation where a login account belongs to different organizations. Therefore, after determining that the user has the permission to access the encrypted file, it is inquired whether the login account belongs to the organization, and users who do not belong to the organization are excluded. The user who sends the request is screened layer by layer and obtains the organization's permission to use. Then the encrypted file is decrypted using the file key to obtain the decrypted file. The encrypted file is decrypted based on the dual verification of the organization and the individual, which improves the security of the encrypted file.
[0027] Furthermore, the organization is provided with temporary users, and uses the organization key to perform temporary decryption operations for the temporary users, and caches the basic information of the temporary users in a verification database.
[0028] The above-mentioned organizational key is used to perform temporary decryption for temporary users in a targeted manner, so that the temporary users obtain the authority to temporarily use the internal files of the organization. After obtaining the authority to use some internal files of the organization, if the temporary user needs to use the encrypted file, the encrypted file needs to be decrypted. Only after the decryption is successful can the decrypted file be obtained and subsequent use operations can be performed. If the decryption of the temporary user fails, the temporary user does not have the conditions to use the encrypted file.
[0029] Further, determining whether the user is a temporary user designated by the organization includes the following steps:
[0030] After receiving the external request from the user, the basic information of the user is matched with the basic information of the temporary user in the verification database. If the basic information of the temporary user corresponding to the basic information of the user is matched in the verification database, the user is a temporary user; otherwise, the user is not a temporary user.
[0031] The above basic information includes but is not limited to e-mail addresses. The verification database stores the basic information of temporary users. It verifies whether the organization has the basic information of the user in the verification database. If the basic information of the user exists, the user is a temporary user designated by the organization, and the user obtains the right to temporarily use some files within the organization. When the organization removes the basic information of the temporary user from the verification database, the temporary user's right to use some files within the organization will be closed, and ordinary files are protected. The ordinary file can only be used after obtaining the organization's permission and having the permission to use the ordinary file. For encrypted files, in addition to obtaining the organization's permission and the permission to access the encrypted file, the encrypted file also needs to be decrypted to obtain the decrypted file before it can be used.
[0032] Furthermore, if the user is a temporary user designated by the organization, the user is configured with usage permissions, accessible time, and accessible encrypted files, a file key is sent to the user, the encrypted file is decrypted, and a decrypted file is obtained.
[0033] The usage permissions, accessible time and accessible encrypted files of the above-mentioned temporary users are all set by the organization. The organization performs targeted temporary decryption operations on the encrypted files, which can only be accessed by designated temporary users, and sends a file key to the temporary user separately. The temporary user uses the file key to decrypt the encrypted file and obtain the decrypted file. When using the encrypted file, the user must first use the above-mentioned organization key to obtain the organization's permission to further obtain the encrypted file. After obtaining the encrypted file, the above-mentioned file key is used to decrypt the encrypted file, thereby realizing multiple protections for the encrypted files and improving the security of the encrypted files.
[0034] Furthermore, after the access time configured for the temporary user exceeds, the organization key is no longer used to perform temporary decryption operations for the temporary user, and the decrypted file used by the temporary user is restored to an encrypted state.
[0035] The above-mentioned organization uses the organizational key to open the access rights of temporary users to some files within the organization, but limits the time for opening the rights. After the temporary user reaches the access time, the temporary user's access rights to enter the organization to use some files will be automatically closed. The encrypted file can realize internal and external communication, and protect the encrypted files sent externally, which improves the processability and security of the encrypted files.
[0036] Furthermore, after closing the usable rights of the temporary user, the temporary decryption operation for the temporary user is released, and the decrypted file used by the temporary user is restored to the encrypted state.
[0037] In addition to controlling temporary users' access to the organization through the above accessible time, you can also directly close temporary users' access to the organization from within the organization.
[0038] Compared with the prior art, the present invention has the following advantages and beneficial effects:
[0039] Bind the file uploaded by the above user to the organization to which the user belongs, and then encrypt the file so that the encryption operation of the file is performed based on the dual verification of the organization and the individual;
[0040] For requests within the organization, the decryption operation can be completed by verifying the user's identity information, so that the user of the encrypted file is a user within the organization, and then the encrypted file is decrypted using the key, so that the operation of decrypting the file within the organization is based on the dual verification of the organization and the individual, which improves the security of the file;
[0041] The internal request is to verify the user's identity information. Once the verification is passed, the encrypted file can be decrypted using the key, which removes the closeness of the connection between the user and the designated computer. This solves the problem that the existing encryption and decryption programs can only guarantee that the files in the computer can only be opened in one's own computer, or identify which computers can open company files based on the computer network card MAC address whitelist, resulting in employees being unable to process any work files on non-work computers, thereby improving the processability of encrypted files.
[0042] For requests from outside the organization, the user must be a temporary user designated by the organization and have the corresponding authority to obtain the key of the encrypted file, and use this key to decrypt the encrypted file to obtain the decrypted file. The operation of decrypting the encrypted file outside the organization is also based on the dual verification of the organization and the individual, which further improves the security of the encrypted file. An access time is set for temporary users. If the access time is exceeded, the authority will be terminated, making the temporary user lose the qualification to use the encrypted file. The encrypted files sent out can also be managed and controlled, which improves the security of the encrypted files and solves the current problem that the encrypted files sent out cannot be protected. BRIEF DESCRIPTION OF THE DRAWINGS
[0043] In order to more clearly illustrate the technical solutions of the exemplary embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and should not be regarded as limiting the scope. For those of ordinary skill in the art, other relevant drawings can be obtained based on these drawings without creative work. In the drawings:
[0044] Figure 1 This is a flow chart provided for Example 1. DETAILED DESCRIPTION
[0045] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with embodiments and drawings. The exemplary embodiments of the present invention and their description are only used to explain the present invention and are not intended to limit the present invention.
[0046] The present invention utilizes the RSA2 asymmetric encryption algorithm to protect the file data uploaded and managed by all users in the system, and completes the decryption analysis based on the matching of the previous year and the verification of the enterprise and personal identity. When the file data needs to be connected with the internal and external processes, the system administrator can directly control the operation authority and duration of the file by the external personnel, so as to realize the protection of the outgoing files, and solve the problem that the outgoing files cannot be protected and controlled at present.
[0047] Example 1
[0048] This embodiment 1 provides a file management method to prevent leakage, such as Figure 1 As shown, the following steps are included:
[0049] S1. After receiving the file uploaded by the user, bind the file to the organization of the user and encrypt the file to obtain the encrypted file and key;
[0050] S2. After receiving the request sent by the user, determine the source of the request;
[0051] S21. If the request comes from within the organization, verify the user's identity information:
[0052] S211. If the verification is successful, the encrypted file is decrypted using the key to obtain a decrypted file;
[0053] S212. If the verification fails, the user authentication fails and does not have the authority to decrypt the encrypted file;
[0054] S22. If the request comes from outside the organization, determine whether the user is a temporary user designated by the organization;
[0055] S221. If the user is a temporary user designated by the organization, the permissions and access time are configured for the user, a key is sent to the user, the encrypted file is decrypted, and the decrypted file is obtained;
[0056] S222. If the user is not a temporary user designated by the organization, the user authentication fails and does not have the authority to obtain the encrypted file.
[0057] Bind the file uploaded by the above user to the organization to which the user belongs, and then encrypt the file so that the encryption operation of the file is performed based on the dual verification of the organization and the individual;
[0058] For requests within the organization, the decryption operation can be completed by verifying the user's identity information, so that the user of the encrypted file is a user within the organization, and then the encrypted file is decrypted using the key, so that the operation of decrypting the file within the organization is based on the dual verification of the organization and the individual, which improves the security of the file;
[0059] The above internal request is made by verifying the user's identity information. Once the verification is passed, the key can be used to decrypt the above encrypted file, which removes the closeness of the connection between the user and the designated computer. It solves the problem that the existing encryption and decryption programs can only guarantee the files in the computer and can only be opened in one's own computer, or identify which computers can open company files based on the computer network card MAC address whitelist, resulting in employees being unable to process any work files on non-work computers. This improves the processability of encrypted files.
[0060] For requests from outside the organization, the user must be a temporary user designated by the organization and have the corresponding permissions to obtain the key of the encrypted file, and use this key to decrypt the encrypted file to obtain the decrypted file. The operation of decrypting the encrypted file outside the organization is also based on the dual verification of the organization and the individual, which further improves the security of the encrypted file. An access time is set for temporary users. If the access time is exceeded, the permission will be terminated, making the temporary user lose the qualification to use the encrypted file. The encrypted files sent out can also be managed and controlled, which improves the security of the encrypted files.
[0061] In a specific embodiment, the uploaded files are encrypted using the RSA2 asymmetric encryption algorithm, which is difficult to crack for ordinary computers.
[0062] In a specific embodiment, the key includes an organization key. After the organization key is obtained, the organization key is bound to the organization.
[0063] As the owner of the encrypted file, the above-mentioned organization needs to use the above-mentioned organization key to obtain the organization's permission to further obtain the encrypted file when decrypting the above-mentioned encrypted file. The above-mentioned encrypted file is multiple-protected, thereby improving the security of the encrypted file.
[0064] In a specific embodiment, the key further includes a file key. After the file key is obtained, the file key is bound to the encrypted file.
[0065] After obtaining the organization's use permission using the above-mentioned organization key, the encrypted file is further obtained, and the encrypted file is decrypted using the above-mentioned file key to obtain the decrypted file. The above-mentioned encrypted file is multiplexed for protection, thereby improving the security of the encrypted file.
[0066] In a specific embodiment, the specific steps for verifying the user's identity information are as follows:
[0067] After receiving the user's internal request, send verification information to the user;
[0068] After receiving the verification information, the user sends the login account and password for preliminary verification of the user's identity information;
[0069] After receiving the above login account and login password, the above login account is matched with the verification account in the verification database. If the verification account corresponding to the login account is matched in the above verification database, the verification password associated with the verification account is extracted from the verification database, and the above login password is matched with the extracted verification password. If the verification password corresponding to the login password is matched in the extracted verification password, the preliminary verification is passed; otherwise, the preliminary verification fails and the preliminary verification operation needs to be performed again;
[0070] After the initial verification is passed, check whether the login account has the permission to use the encrypted file. If the login account has the permission to use the encrypted file, the secondary verification is passed; otherwise, the secondary verification fails and the user cannot use the encrypted file.
[0071] After the second verification is passed, it is checked whether the login account belongs to the organization. If the login account belongs to the organization, the third verification is passed, and the file key of the encrypted file is obtained. The encrypted file is decrypted using the file key to obtain the decrypted file; otherwise, the three verifications fail and the user cannot use the encrypted file.
[0072] For the above-mentioned requests within the organization, it is preliminarily verified whether the user's login account and password are correct. After the verification is passed, it is necessary to query whether the above-mentioned login account has the permission to use the encrypted file. First, users who do not have access to the encrypted file are excluded, reducing system congestion and improving access efficiency. Because the present invention adopts a cloud-based open SaaS product, which is different from a local area network system that is not connected to the Internet, there is a situation where a login account belongs to different organizations. Therefore, after determining that the user has the permission to access the encrypted file, it is queried whether the login account belongs to the organization, and users who do not belong to the organization are excluded. The user who sends the request is screened layer by layer and obtains the organization's permission to use. Then the encrypted file is decrypted using the file key to obtain the decrypted file. The encrypted file is decrypted based on the dual verification of the organization and the individual, which improves the security of the encrypted file.
[0073] In a specific embodiment, the organization is provided with a temporary user, and the organization key is used to perform a temporary decryption operation for the temporary user, and the basic information of the temporary user is cached in a verification database.
[0074] The above-mentioned organizational key is used to perform temporary decryption for temporary users in a targeted manner, so that the temporary users obtain the authority to temporarily use the internal files of the organization. After obtaining the authority to use some internal files of the organization, if the temporary user needs to use the encrypted file, the encrypted file needs to be decrypted. Only after the decryption is successful can the decrypted file be obtained and subsequent use operations can be performed. If the decryption of the temporary user fails, the temporary user does not have the conditions to use the encrypted file.
[0075] In a specific embodiment, determining whether the user is a temporary user designated by the organization includes the following steps:
[0076] After receiving the user's external request, the user's basic information is matched with the basic information of the temporary user in the above verification database. If the basic information of the temporary user corresponding to the basic information of the user is matched in the above verification database, the user is a temporary user; otherwise, the user is not a temporary user.
[0077] The above basic information includes but is not limited to e-mail addresses. The verification database stores the basic information of temporary users. It verifies whether the organization has the basic information of the user in the above verification database. If the basic information of the user exists, the user is a temporary user designated by the organization, and the user obtains the authority to temporarily use some files within the organization. When the organization removes the basic information of the temporary user from the verification database, the temporary user's authority to use some files within the organization will be closed, and ordinary files are protected. The ordinary file can only be used after obtaining the organization's permission and having the authority to use the ordinary file. For encrypted files, in addition to obtaining the organization's permission and the authority to access the encrypted file, the encrypted file also needs to be decrypted to obtain the decrypted file before it can be used.
[0078] In a specific embodiment, if the user is a temporary user designated by the organization, the user is configured with usage permissions, accessible time, and accessible encrypted files, a file key is sent to the user, the encrypted file is decrypted, and a decrypted file is obtained.
[0079] The usage permissions, accessible time and accessible encrypted files of the above-mentioned temporary users are all set by the organization. The organization performs targeted temporary decryption operations on the encrypted files, which can only be accessed by designated temporary users, and sends a file key to the temporary user separately. The temporary user uses the file key to decrypt the encrypted file and obtain the decrypted file. When using the encrypted file, the user must first use the above-mentioned organization key to obtain the organization's permission to further obtain the encrypted file. After obtaining the encrypted file, the above-mentioned file key is used to decrypt the encrypted file, thereby realizing multiple protections for the encrypted files and improving the security of the encrypted files.
[0080] In a specific embodiment, after the access time configured for the temporary user exceeds, the temporary decryption operation for the temporary user using the organization key is terminated, and the decrypted file used by the temporary user is restored to the encrypted state.
[0081] The above-mentioned organization uses the organizational key to open the access rights of temporary users to some files within the organization, but limits the time for opening the rights. After the temporary user reaches the access time, the temporary user's access rights to enter the organization to use some files will be automatically closed. The encrypted file can realize internal and external communication, and protect the encrypted files sent externally, which improves the processability and security of the encrypted files.
[0082] In a specific embodiment, after closing the usable rights of the temporary user, the temporary decryption operation for the temporary user using the organizational key is cancelled, and the decrypted file used by the temporary user is restored to the encrypted state.
[0083] In addition to controlling temporary users' access to the organization through the above accessible time, you can also directly close temporary users' access to the organization from within the organization.
[0084] Example 2
[0085] Step 1: Bind the uploaded file to the enterprise, making the enterprise the owner of the file. The system uses the RSA2 asymmetric encryption algorithm to encrypt the uploaded file to obtain the encrypted file, the organization key and the file key; bind the above organization key to the enterprise, and bind the above file key to the encrypted file;
[0086] Step 2: When the encrypted file needs to be accessed (including but not limited to browsing, calling within the system or downloading), first determine whether the request is from within the enterprise or outside;
[0087] Step 3: When the request comes from within the enterprise, verify the correctness of the login account and password of the person in need when logging into the system, and then check whether the role of the login account has the access right to the encrypted file;
[0088] Step 4: Because the system is a cloud-based open SaaS product, unlike a local area network system that is not connected to the Internet, there is a situation where a login account belongs to a different company. After completing step 3, the system needs to verify again whether the company of the login account is the owner of the encrypted file;
[0089] Step 5: After the authentication of step 3 and step 4 is passed, it is considered that the organization key matches, and the encrypted file is decrypted using the file key to obtain the decrypted file. The user can complete browsing, downloading and other operations according to his or her own authority in the system;
[0090] Step 6: When the request comes from outside the enterprise, only the system administrator within the enterprise can use the organization key to perform targeted temporary decryption for the user. First, the administrator enters the email address of the external person;
[0091] Step 7. The administrator sets the specific number of files that external personnel can access, the access password, the number of days they can access, and whether they can print, download files, or only browse them online;
[0092] Step 8. After completing steps 6 and 7, the administrator sends the URL and access password to the external person. After the external person opens it, the system decrypts the encrypted file according to the permissions set by the administrator and provides access to the external person. When the number of accessible days exceeds or the administrator manually terminates the permissions in advance, the temporary decryption is lifted and the file returns to the encrypted state. The encrypted file cannot be accessed by external persons.
[0093] The present invention breaks through the problem that traditional encryption and decryption programs need to be deployed simultaneously on the local server and computer terminal, and that the encryption and decryption scope of files in the computer terminal is determined by complex rules, resulting in high implementation costs and the ability to operate files only through designated computers. It also solves the problem that Internet-based information systems often do not have file data encryption functions, resulting in the risk of loss of corporate data assets. In the present invention, all encryption and decryption operations are automatically performed by the system based on dual authentication of the enterprise and the individual, thus avoiding the problem of human operational errors and improving efficiency. When internal files need to be communicated with the outside, the system administrator will open the permissions of designated external personnel and temporarily decrypt them for the external personnel, thereby opening up the use permissions of some files within the organization.
[0094] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.
Claims
1. A file management method for preventing leakage, characterized in that: The following steps are involved: After receiving the file uploaded by the user, the file is bound to the organization of the user and the file is encrypted to obtain the encrypted file and key; After receiving the request sent by the user, determine the source of the request. If the request comes from within the organization, verify the identity information of the user. If the verification is successful, use the key to decrypt the encrypted file to obtain the decrypted file. If the request comes from outside the organization, determine whether the user is a temporary user designated by the organization. If the user is a temporary user designated by the organization, configure permissions and access time for the user, send a key to the user, decrypt the encrypted file, and obtain a decrypted file.
2. A file management method for preventing leakage according to claim 1, characterized in that: The uploaded files are encrypted using the RSA2 asymmetric encryption algorithm.
3. A file management method for preventing leakage according to claim 1, characterized in that: The key includes an organization key. After the organization key is obtained, the organization key is bound to the organization.
4. A file management method for preventing leakage according to claim 1, characterized in that: The key also includes a file key. After the file key is obtained, the file key is bound to the encrypted file.
5. A file management method for preventing leakage according to claim 1, characterized in that: The specific steps to verify the user's identity information are as follows: After receiving the user's internal request, send verification information to the user; After receiving the verification information, the user sends the login account and password for preliminary verification of the user's identity information; After receiving the login account and login password, the login account is matched with the verification account in the verification database. If the verification account corresponding to the login account is matched in the verification database, the verification password associated with the verification account is extracted from the verification database, and the login password is matched with the extracted verification password. If the verification password corresponding to the login password is matched in the extracted verification password, the preliminary verification is passed; otherwise, the preliminary verification fails and the preliminary verification operation needs to be performed again; After the initial verification is passed, check whether the login account has the permission to use the encrypted file. If the login account has the permission to use the encrypted file, the secondary verification is passed; otherwise, the secondary verification fails and the user cannot use the encrypted file. After the second verification is passed, it is checked whether the login account belongs to the organization. If the login account belongs to the organization, the third verification is passed, and the file key of the encrypted file is obtained. The encrypted file is decrypted using the file key to obtain the decrypted file; otherwise, the three verifications fail and the user cannot use the encrypted file.
6. A file management method for preventing leakage according to claim 1, characterized in that: The organization is provided with a temporary user, uses the organization key to perform a temporary decryption operation for the temporary user, and caches the basic information of the temporary user in a verification database.
7. A file management method for preventing leakage according to claim 6, characterized in that: Determining whether the user is a temporary user designated by the organization includes the following steps: After receiving the external request from the user, the basic information of the user is matched with the basic information of the temporary user in the verification database. If the basic information of the temporary user corresponding to the basic information of the user is matched in the verification database, the user is a temporary user; otherwise, the user is not a temporary user.
8. A file management method for preventing leakage according to claim 7, characterized in that: If the user is a temporary user designated by the organization, the user is configured with usage permissions, accessible time, and accessible encrypted files, a file key is sent to the user, the encrypted file is decrypted, and a decrypted file is obtained.
9. A file management method for preventing leakage according to claim 8, characterized in that: After the access time configured for the temporary user exceeds, the organization key is no longer used to perform temporary decryption operations for the temporary user, and the decrypted files used by the temporary user are restored to an encrypted state.
10. A file management method for preventing leakage according to claim 8, characterized in that: After closing the temporary user's usage authority, the organization key is no longer used to perform temporary decryption operations for the temporary user, and the decrypted files used by the temporary user are restored to an encrypted state.